NetworkPolicy egress port is hardcoded to 443, breaking clusters whose API endpoint is on 6443 (kind, many self-managed)

Summary

The chart's optional NetworkPolicy hardcodes egress to TCP port 443. NetworkPolicy is evaluated against the API server endpoint port (post-service-DNAT), which on many self-managed clusters — and on kind — is 6443. On such clusters, enabling reloader.netpol.enabled: true blocks Reloader's Kubernetes API access entirely: the pod starts, hangs on API connectivity, fails its probes, and crash-loops. There is currently no value to change the port.

Reproduction (kind, Kubernetes v1.36.1, chart from master)

kind create cluster --name reloader-netpol
kubectl create ns reloader
helm install reloader ./deployments/kubernetes/chart/reloader \
  -n reloader \
  --set reloader.netpol.enabled=true

Result: pod stuck 0/1 Running with restarts, exit code 2 after ~50s; probe failures:

Warning  Unhealthy  Liveness probe failed: Get "http://10.244.0.5:9090/live": connect: connection refused
Warning  Unhealthy  Readiness probe failed: Get "http://10.244.0.5:9090/metrics": connect: connection refused

Upgrading the same release with --set reloader.netpol.enabled=false makes the pod Ready immediately and reload functionality works — confirming the NetworkPolicy is the cause.

The kind API endpoint is on 6443:

$ kubectl get endpoints kubernetes
NAME         ENDPOINTS           AGE
kubernetes   172.18.0.2:6443     2m

Managed control planes (EKS, GKE, AKS) expose the endpoint on 443 and are unaffected, which is presumably why this hasn't been reported more often.

Current template

deployments/kubernetes/chart/reloader/templates/networkpolicy.yaml:

  egress:
    - ports:
        - port: 443
      {{- with .Values.reloader.netpol.to}}
      to:
        {{- toYaml .| nindent 8 }}
      {{- end }}

netpol.to can narrow the destination, but nothing can change or add the port.

Proposal

Make the egress ports configurable with the current behavior as default, e.g.:

reloader:
  netpol:
    enabled: false
    egressPorts: [443]   # set to [6443] (or [443, 6443]) for clusters whose API endpoint is not on 443

  egress:
    - ports:
      {{- range .Values.reloader.netpol.egressPorts }}
        - port: {{ . }}
          protocol: TCP
      {{- end }}

Alternatives: accept a full netpol.egress rule list for maximum flexibility, or document that users must check kubectl get endpoints kubernetes before enabling (the docs now carry this caveat, but a configurable port is the real fix).

Context

Found while validating the hardened production baseline (restricted PSS + netpol) for the Reloader Enterprise security documentation. Related least-privilege issue: #1221.

Happy to send a PR.